Director
Create Filters
Filters process a traffic stream by selecting packets based on criteria in the packet header. A filter is defined using a filter add command, which also specifies the Network ports and Monitor ports the filters apply to. The filter add command specifies the following behavior:
•Traffic is aggregated from all the listed Network ports
•Then the filter parameters are applied
•Packets which match all of the specified filter parameters are copied to all of the listed Monitor ports, assuming the action=redir.
•If the action=drop, the matching packets are not copied to any Monitor port; this mechanism is used to create exclusive filters.
To send Monitor Port 1 all traffic received at Network Port 5 from IP addresses 192.168.10.0 to 192.168.10.15:
1.Enter filter add in_ports=n1.5 ip_src=192.168.10.0 ip_src_mask= 255.255.255.240 action=redir redir_ ports=m.1. A filter has been defined to select all IPv4 packets from Network Port 5 with a source IP addresses of 192.168.10.0 and the lowest four address bits masked out (ignored); packets matching the filter are copied to
Monitor Port 1.
2.Enter filter commit. The filter is activated.
Source IP =
Network Port 5 
192.168.10.0 - 
Monitor Port 1
192.168.10.15
lter add in_ports=n1.5 ip_src=192.168.10.0 ip_src_mask=255.255.255.240 action=redir redir_ports=m.1
Figure 26: Simple IP address filter
To create a filter that selects IPv4 packets by protocol:
1.Enter filter add in_ports=n1.3 ip4_prot=3 action=redir redir_ports=m.6,m.8. A filter has been defined to select all IPv4 packets that use the TCP protocol received at Network Port 3 and copy them to Monitor Port 6 and Monitor
Port 8. (Protocols are designated by an
2.Enter filter commit. The filter is activated.
Network Port 3 |
| Protocol = |
| TCP | |
|
|
Monitor Port 6
Monitor Port 8
lter add in_ports=n1.3 ip4_prot=3 action=redir redir_ports=m.6,m.8
Figure 27: Simple IPv4 protocol filter (with regeneration)
Available filter parameters are listed in Appendix B and include:
• ip_proto | IP protocol |
28
